admin/dev_agent_team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adopt canonical permission standard v1 + installer verification gate

Browse Source
This commit is contained in:
Your Name
2026-08-24 15:51:09 -04:00
parent 53571e9cd0
commit 66564a1eaa
27 changed files with 287 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/architect.md
+18 -2
View File
@@ -2,22 +2,38 @@
name: architect
description: Evidence-driven architecture and scope decision agent for defining boundaries, ownership, interfaces, and implementation direction
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"**/AgentsReport/**": allow
"AgentsReport/architect/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git rev-parse*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/builder.md
+9
View File
@@ -2,7 +2,16 @@
name: builder
description: Scope-controlled implementation agent for approved changes
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/designer.md
+29 -1
View File
@@ -2,10 +2,38 @@
name: designer
description: Evidence-driven UI/UX design agent responsible for visual design, interaction patterns, accessibility, and user experience specifications
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
edit:
"**": deny
"AgentsReport/designer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/detective.md
+30 -2
View File
@@ -2,9 +2,37 @@
name: detective
description: Evidence-first, hypothesis-driven root-cause investigator for technical failures and suspicious behavior
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: deny
bash: ask
edit:
"**": deny
"AgentsReport/detective/**": allow
bash:
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/explorer.md
+18 -2
View File
@@ -2,22 +2,38 @@
name: explorer
description: Read-only, evidence-first investigator for understanding unfamiliar systems, repositories, and technical problems
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"**/AgentsReport/**": allow
"AgentsReport/explorer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git rev-parse*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/maintainer.md
+9
View File
@@ -2,7 +2,16 @@
name: maintainer
description: Scope-aware maintenance agent for keeping an existing system consistent with its established standards
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/orchestrator.md
+6
View File
@@ -2,7 +2,13 @@
name: orchestrator
description: Coordination agent that routes work across specialist agents while preserving scope, evidence, and handoff discipline
mode: primary
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
bash: allow
task: allow
---
agents/philosopher.md
+30 -1
View File
@@ -2,10 +2,39 @@
name: philosopher
description: Evidence-driven discovery agent that finds the purpose, meaning, and soul of a project before any technical work begins
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
edit:
"**": deny
"philosophy.md": allow
"AgentsReport/philosopher/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/reviewer.md
+18 -2
View File
@@ -2,22 +2,38 @@
name: reviewer
description: Read-only, adversarial review agent that verifies completed implementations, maintenance changes, and tooling against approved scope and requirements before acceptance
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"**/AgentsReport/**": allow
"AgentsReport/reviewer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git rev-parse*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/tester.md
+7
View File
@@ -2,9 +2,16 @@
name: tester
description: Evidence-driven testing specialist responsible for test strategy, test architecture, test implementation, and quality verification
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/toolsmith.md
+31
View File
@@ -2,7 +2,38 @@
name: toolsmith
description: Practical automation and tooling agent for turning repeated problems into reliable mechanical prevention
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/toolsmith/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---
agents/writer.md
+22 -2
View File
@@ -2,20 +2,40 @@
name: writer
description: Evidence-driven documentation specialist responsible for creating technical documentation, API references, user guides, ADRs, and release notes
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit: allow
edit:
"**": deny
"docs/**": allow
"README*": allow
"AgentsReport/writer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git rev-parse*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
webfetch: deny
websearch: deny
skill: deny
task: deny
---